使用Python實現(xiàn)監(jiān)控進程是否有病毒

更新時間：2024年02月27日 15:32:08 作者：白客小李666

這篇文章主要為大家詳細介紹了如何使用Python實現(xiàn)監(jiān)控進程是否有病毒,文中的示例代碼講解詳細,感興趣的小伙伴可以跟隨小編一起學習一下

程序流程圖

實現(xiàn)監(jiān)控進程

導包

這里，我們需要用一個特別的庫，叫做psutil

import psutil

處理進程信息

然后我們創(chuàng)建一個列表，里面存儲進程的信息

processes = []
for process in psutil.process_iter():
    try:
        process_info = process.as_dict(attrs=['pid', 'name', 'username', 'cpu_percent', 'memory_info','exe'])
        processes.append(process_info)
    except:
        pass

有興趣的讀者可以讀取一下processes這個列表，里面很亂，其中記錄了系統(tǒng)中的每一個進程的信息，并把每一組信息弄成一個字典

這里以svchost.exe為例

然后我們就可以看到這個程序的信息了

檢測文件是否是病毒

殺毒引擎就不過多介紹了，請大家參考：使用Python制作一個惡意軟件刪除工具

這里也可以連一下360殺毒引擎

import requests
import xml.etree.ElementTree as xmlet
def clouds_scan_Engine(file):
    """接入360云掃描引擎"""
    try:
        with open(file, "rb") as f:
            text = str(hashlib.md5(f.read()).hexdigest())
        strBody = f'-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="md5s"\r\n\r\n{text}\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="format"\r\n\r\nXML\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="product"\r\n\r\n360zip\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="combo"\r\n\r\n360zip_main\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="v"\r\n\r\n2\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="osver"\r\n\r\n5.1\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="vk"\r\n\r\na03bc211\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="mid"\r\n\r\n8a40d9eff408a78fe9ec10a0e7e60f62\r\n-------------------------------7d83e2d7a141e--'
        response = requests.post('http://qup.f.#/file_health_info.php', data=strBody, timeout=3)
        if response.status_code == 200:
            level = float(xmlet.fromstring(response.text).find('.//e_level').text)
            if level > 50: #判斷是否是病毒
                return "Virus"
            elif level <= 10:
                return "Safe"
            return "Unknown"
        return f"Error: {response.status_code}"
    except Exception as e:
        return f"Error: {e}"

這里就用PYAS的密鑰了，我沒密鑰，連不上

報毒

殺毒引擎和監(jiān)控文件進程的程序都弄好了，那怎么報毒呢

messagebox？不太現(xiàn)實，如果你正工作呢中間給你來個彈窗，不嚇人嗎

所以這里我們用plyer的右下角彈窗,這個庫我自認為穩(wěn)定一點，因為當時我用win10toast打包不成功（咋整都不行）。

導包

from plyer import notification

彈窗

def notifier(message):
    notification.notify(title="Anti Virus",message=message,app_icon = None,timeout = 3)
                         #標題             #信息                   #圖標        #顯示的時間

彈出來了（要是彈不出來重啟電腦再試一次基本就行了）

總代碼

#! python3.9.0
# -*- coding:ANSI -*-
#作者:白客小李666
#創(chuàng)建日期:2024-2-14
#版本號:V1.0
import os
import time
import hashlib
import subprocess
import psutil
import requests
import xml.etree.ElementTree as xmlet
import tkinter.messagebox as messagebox
from plyer import notification
import win32file, win32con
 
def notifier(message):
    notification.notify(title="PF Anti Virus",message=message,app_icon = None,timeout = 3)
def clouds_scan_Engine(file):
    """接入360云掃描引擎"""
    try:
        with open(file, "rb") as f:
            text = str(hashlib.md5(f.read()).hexdigest())
        strBody = f'-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="md5s"\r\n\r\n{text}\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="format"\r\n\r\nXML\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="product"\r\n\r\n360zip\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="combo"\r\n\r\n360zip_main\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="v"\r\n\r\n2\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="osver"\r\n\r\n5.1\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="vk"\r\n\r\na03bc211\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="mid"\r\n\r\n8a40d9eff408a78fe9ec10a0e7e60f62\r\n-------------------------------7d83e2d7a141e--'
        response = requests.post('http://qup.f.#/file_health_info.php', data=strBody, timeout=3)
        if response.status_code == 200:
            level = float(xmlet.fromstring(response.text).find('.//e_level').text)
            if level > 50: #判斷是否是病毒
                return "Virus"
            elif level <= 10:
                return "Safe"
            return "Unknown"
        return f"Error: {response.status_code}"
    except Exception as e:
        return f"Error: {e}"
Virus_Reservoirs=[
                 '40d8911754a4d6cd8d4c732f96eb3016',#無限cmd彈窗
                 '13a46d4fd98cac46bc95fc1ca6dd8c56',#無限cmd彈窗
                 '0d686bf04da1a4d11ea197375b99a48b',#無限cmd彈窗
                 'eda588c0ee78b585f645aa42eff1e57a',#中華黑豹升級版
                 '19dbec50735b5f2a72d4199c4e184960',#MEMZ彩虹貓
                 '815b63b8bc28ae052029f8cbdd7098ce',#滑稽病毒
                 'c71091507f731c203b6c93bc91adedb6',#盧本偉病毒
                 '0a456ffff1d3fd522457c187ebcf41e4',#蠕蟲
                 '1aa4c64363b68622c9426ce96c4186f2',#BIOS、MBR病毒
                 'd214c717a357fe3a455610b197c390aa',#Virus.Win32.disttrackA類型病毒
                 'b14299fd4d1cbfb4cc7486d978398214',#Virus.Win32.disttrackA類型病毒
                 'dffe6e34209cb19ebe720c457a06edd6',#無盡黑洞木馬病毒
                 '512301c535c88255c9a252fdf70b7a03',#熊貓燒香
                 'd4a05ada747a970bff6e8c2c59c9b5cd',#WormOrg.Viking.A -->蠕蟲
                 'ad41ec81ab55c17397d3d6039752b0fd',#WormOrg.Win32.Fujack.A  -->蠕蟲
                 'a57db79f11a8c58d27f706bc1fe94e25',#Virus.Win32.Viking.A類型病毒
                 'fc14eaf932b76c51ebf490105ba843eb',#沖擊波
                 '2a92da4b5a353ca41de980a49b329e7d',#蠕蟲
                 '68abd642c33f3d62b7f0f92e20b266aa',#蠕蟲
                 'ff5e1f27193ce51eec318714ef038bef',#蠕蟲
                 '4c36884f0644946344fa847756f4a04e',#磁碟機
                 '2391109c40ccb0f982b86af86cfbc900',#AV終結(jié)者——>Pabug
                 '915178156c8caa25b548484c97dd19c1',#可刪除文件的蠕蟲
                 'dac5f1e894b500e6e467ae5d43b7ae3e',#可刪除文件的蠕蟲
                 '84c82835a5d21bbcf75a61706d8ab549',#WannaCry永恒之藍
                 'db349b97c37d22f5ea1d1841e3c89eb4',#WannaCry永恒之藍
                 '1de73f49db23cf5cc6e06f47767f7fda',#WannaRen
                 'af2379cc4d607a45ac44d62135fb7015',#Petya
                 '71b6a493388e7d0b40c83ce903bc6b04',#Petya組件
                 'e81139675ac1b806d689fb17789e2f99',#斯大林病毒
                 '849da18699ea2332494e431c66be0ca6',#WindowsCrazyError
                 '56975ae355acb292220921ad61c58f2a',#MBR破壞
                 '44d88612fea8a8f36de82e1278abb02f',#引擎測試程序
                 '297de74cb20a975efaf20cd88fddf270',#鬼影木馬
                 'c729d940eb78e927afcba4046543d8f8',#可讓系統(tǒng)藍屏的病毒
                 '8c71f2a4b3079332d4f8078eddb9974a',#小豬佩奇病毒
                 "8c689f65508e1353fb3df35df87ba5c7",#'假藍屏'病毒
                 'f84765b1eb6fc25f1ac48b9d3a53b255', 
                 'dabe78f82700ccf74e0d2bfefb49dd1c', 
                 'd067a550d2a3489e0f6f75bb8e20a6f8',
                 '4544bb3a1f838959ef72b511873f1908', 
                 '8c13bb49dfaf8f0daa42b404d5227f29', 
                 '6e964d9effc5d3e888db037fb1a0f6d5', 
                 'dd51b7493ba47c2a8ad831214640c86e', 
                 'ceeea2aa492f9665a581d9878b6ca560', 
                 'cb0a6cf97767ba655f517ac009226e8a', 
                 '262e179b3432d3bcf8d82783efea7941', 
                 '9d73825b2d64701e2f6c854523aa6130',
                 'a85810a9b80fe17d668259c01c1603e5', 
                 '84e5ccdfbdfd9d92456c890e6d8641d4', 
                 '97cda21c64590b5c7145582da1f3bdcc', 
                 '17b3dae40d5084b0c04faf09b40d1188',
                 '1a57f3e87c8f0da948aac575ec3b0bf6',
                 '1a014f843176d194a6ecfafc872c00cb',
                 'e5215927d2a1f245f752d34c1c281a66', 
                 '0a2e0ab41ec0adc7b5cc6da2b6f71796', 
                 '07c39cc37fc5a625d037e47c2de67140',
                 'fe7d53cf0d0767b6a1a5063f104bd95a',
                 '23b09b6230c63d21c035d716f74c2b4f', 
                 '53b00ae9be4847348be142d94b857998',
                 '523983e00238f69d0d44687d85b5ff7e',
                 'c207d67faa4433dacdda40a3a98e740b',
                  '1c21f88d33bdb8570c813a57382c1069',
                  '942e52b69f0452ac604df829e4d8b2a7', 
                  '0d6d8ece825ac156ec7331111721e6a0',
                '0067366016a1a7feb93cf8befeb1a5f8',
                '041019de368b2b914be10149421be2a5', 
                '332f9ec09fede19ed545c19e661d4e89']
 
class anti_viruses:
     global Virus_Reservoirs,clouds_scan_Engine,notifier
     def anti_virus1():
        """實時掃描進程"""
        def getFileMD5(file):
            f_ob=open(file,"rb")
            f_content=f_ob.read()
            f_ob.close()
            file_md5=hashlib.md5(f_content)
            return file_md5.hexdigest()
        processes = []
        for process in psutil.process_iter():
            try:
                process_info = process.as_dict(attrs=['pid', 'name', 'username', 'cpu_percent', 'memory_info','exe'])
                processes.append(process_info)
            except:
                pass
        tasks_dir=[]
        for i in processes:
            tasks_dir.append(i['exe'])
        for i in tasks_dir:
            try:
                fileMD5=getFileMD5(i)
                try:
                    file_info=clouds_scan_Engine(i)
                    if fileMD5 in Virus_Reservoirs or file_info == 'Virus':
                        n=os.path.basename(i)
                        subprocess.call(f"taskkill /f /im {n}", creationflags=0x08000000)
                        try:
                            os.unlink(i)
                            notifier(f"發(fā)現(xiàn)病毒{n},已處理")
                        except:
                            notifier(f"發(fā)現(xiàn)病毒{n},處理失敗,請立刻查殺病毒!")
                except:
                    print(i+"文件哈希值:"+fileMD5)
                    if fileMD5 in Virus_Reservoirs :
                        n=os.path.basename(i)
                        subprocess.call(f"taskkill /f /im {n}", creationflags=0x08000000)
                        try:
                            os.unlink(i)
                            notifier(f"發(fā)現(xiàn)病毒{n},已處理")
                        except:
                            notifier(f"發(fā)現(xiàn)病毒{n},處理失敗,請立刻查殺病毒!")
            except:
                pass
            
 
 
if __name__ =='__main__':                   
    while True:
        try:
            anti_viruses.anti_virus1()
            time.sleep(0.5)#休息0.5秒,防止內(nèi)存占用率過高導致程序跑不起來
        except Exception as e:
            messagebox.showerror("error",f"Task Monitor stops working!\nerror code:{e}")